EUVD-2026-12940Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2021 - Broken Access Control
ASVS 5.0
V4 - Access Control Authorization enforcement, RBAC validation
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS and EPSS scores are not provided in the available intelligence, the vulnerability carries meaningful real-world risk due to several factors: the function is part of Python's standard library (affecting broad deployment), information disclosure can lead to exposure of sensitive configuration files or credentials, and the attack complexity appears low since it merely requires calling a standard library function with a malformed argument. The vulnerability is not listed as actively exploited in known exploit databases (KEV status unknown), but the existence of proof-of-concept code in the official CPython issue tracker (github.com/python/cpython/issues/146121) indicates the issue is well-understood and trivially reproducible. The risk profile suggests this should be prioritized for patching in any CPython deployment, particularly in web applications or services that might process untrusted input passed to pkgutil.get_data(). |
| Exploit ScenarioDerived | An attacker could craft a Python application or malicious input that calls pkgutil.get_data() with a path traversal payload such as '../../../etc/passwd' or an absolute path, causing the function to read and return arbitrary system files that the Python process has permission to access. If this functionality is exposed through a web service, API, or any externally-facing interface, sensitive files like configuration files, private keys, or database credentials could be disclosed to an attacker. The low attack complexity means this requires no special privileges or complex exploitation techniques—merely knowledge of how to construct a path traversal string. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
The pkgutil.get_data() function in CPython fails to properly validate the resource argument, enabling path traversal attacks that allow unauthorized information disclosure. This vulnerability affects CPython across multiple versions and could permit attackers to read arbitrary files from the system where Python code is executing. A patch is available from the Python Software Foundation, and the vulnerability has been documented with proof-of-concept references in the official CPython repository.
RemediationAI
Apply the patch available from the Python Software Foundation immediately by upgrading to the patched CPython version as specified in the official security advisory (https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/). The patch has been merged into the CPython repository at https://github.com/python/cpython/pull/146122. Until systems can be patched, code review should identify all uses of pkgutil.get_data() and implement additional input validation on the resource argument to ensure only whitelisted, non-traversal paths are accepted. Applications should also apply the principle of least privilege to limit file system access available to Python processes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Python's pkgutil module, specifically in the get_data() function which is designed to retrieve package resource data. The function is documented to validate resource paths to prevent directory traversal, but this validation was not properly implemented. The root cause falls under CWE path traversal categories, where insufficient input validation allows attackers to use special characters or sequences (such as ../ or absolute paths) to access files outside the intended resource directory. This affects CPython (cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*), which is the reference implementation of the Python programming language used by millions of developers and deployed in countless applications.
Know when Cpython gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
Executive ViewAI
CVE-2026-3479 is a low-severity vulnerability involving path traversal (CVSS 2.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. A patch is available and can be applied during standard maintenance windows.
Apply vendor patch during routine maintenance. Standard path traversal mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in Path Traversal Vulnerabilities
View all 4Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyon
A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archi
Exploit-DB